Identity based behavior measurement architecture

Abstract

A method includes generating a behavioral state for an endpoint device based on actor identities and corresponding subject identities for a plurality of operations wherein for each operation, a respective actor represented by a respective actor identity performs the operation upon a respective subject represented by a respective subject identity. Performance of a later operation by an actor with an actor identity upon a subject with a subject identity is recorded and the actor identity and the subject identity are used to determine that the performance of the later operation does not match the behavioral state and indicates a security risk.

What is claimed is: 
     
       1. A method comprising:
 generating a behavioral state for an endpoint device based on actor identities and corresponding subject identities for a plurality of operations wherein for each operation, a respective actor represented by a respective actor identity performs the operation upon a respective subject represented by a respective subject identity, wherein generating the behavioral state comprises for each of the plurality of operations projecting a contour point based on the actor identity and the subject identity into a unique identity of the endpoint device and combining the projected contour points to form the behavioral state; 
 recording performance of a later operation by an actor having an actor identity upon a subject having a subject identity; and 
 using the actor identity and the subject identity to determine that the performance of the later operation does not match the behavioral state and indicates a security risk. 
 
     
     
       2. The method of  claim 1  wherein the projected contour points are combined in a time-invariant manner. 
     
     
       3. The method of  claim 1  wherein the actor identity is given by the following equation A M =H M  (FA 1  . . . FA N ), where A M  is the actor identity, FA is an actor identity dimension, and H M  is a hash function with a digest size M. 
     
     
       4. The method of  claim 3  wherein the subject identity is given by the following equation S M =H M  (FS 1  . . . FS N ), where S M  is the subject identity, and FS is subject identity dimensions. 
     
     
       5. The method of  claim 4  wherein each contour point for a given actor identity operating on a subject identity is given by the following equation C M =H M  (A M ∥S M ), where C M  is a contour point. 
     
     
       6. The method of  claim 5 , wherein each contour point C M  is projected into the unique identity for the endpoint device through the following equation P M =H M  (D M ∥C M ), where D M  is the unique identity for the endpoint device, C M  is the contour point, and ∥ is a concatenation. 
     
     
       7. The method of  claim 6 , further comprising generating the unique identity for the endpoint device according to the following equation: D M =H M (R M ∥H M (C)), where D M  is the unique identity, R M  is a range value of size M, C is the credential, ∥ is a concatenation, and H M  is the hash function with digest size M. 
     
     
       8. The method of  claim 6 , wherein the endpoint device belongs to an organization provisioning devices, and the method further comprises generating the unique identity for the endpoint device according to the following equation: D M =H M (O M ∥H M (D C )), where D M  is the unique identity, O M  is an identity of an associated organization, D C  is a credential of the endpoint device, ∥ is a concatenation, and H M  is the hash function with digest size M. 
     
     
       9. An endpoint device, comprising:
 memory; and 
 a processor executing instructions to perform steps comprising:
 generating a behavior value based the identities of actors and subjects that were involved in operations performed at least in part on the endpoint device, wherein generating the behavior value comprises for each of the plurality of operations projecting a contour point based on the identity of the actor performing the operation and the identity of the subject upon which the operation is being performed into a unique identity of the endpoint device and combining the projected contour points for the plurality of operations to form the behavior value; 
 receiving an identity of an actor and an identity of a subject involved in a later operation; and 
 using the identity of the actor and the identity of the subject and the behavior value to determine that the later operation is suspect. 
 
 
     
     
       10. The endpoint device of  claim 9  wherein the projected contour points are combined in a time-invariant manner. 
     
     
       11. The endpoint device of  claim 9  wherein the identity of each actor is given by the following equation A M =H M  (FA 1  . . . FA N ), where A M  is the identity of the actor, each FA is an actor identity dimension, and H M  is a hash function with a digest size M. 
     
     
       12. The endpoint device of  claim 11  wherein the identity of each subject is given by the following equation S M =H M  (FS 1  . . . FS N ), where S M  is the identity of the subject, and each FS is a subject identity dimension. 
     
     
       13. The endpoint device of  claim 12  wherein each contour point is given by the following equation C M =H M  (A M ∥S M ), where C M  is the contour point. 
     
     
       14. The endpoint device of  claim 13 , wherein each contour point C M  is projected into the unique identity for the endpoint device through the following equation P M =H M  (D M ∥C M ), where D M  is the unique identity for the endpoint device, C M  is the contour point, and ∥ is a concatenation. 
     
     
       15. The endpoint device of  claim 14 , further comprising generating the unique identity for the endpoint device according to the following equation: D M =H M  (R M ∥H M (C)), where D M  is the unique identity, R M  is a range value of size M, C is the credential, ∥ is a concatenation, and H M  is the hash function with digest size M. 
     
     
       16. The endpoint device of  claim 14 , wherein the endpoint device belongs to an organization provisioning devices, and the method further comprises generating the unique identity for the endpoint device according to the following equation: D M =H M  (O M ∥H M (D C )), where D M  is the unique identity, O M  is an identity of an associated organization, D C  is a credential of the endpoint device, ∥ is a concatenation, and H M  is the hash function with digest size M.